What is ISO 27001?

ISO 27001 is a standard that is recognised internationally for handling the risks that are linked to the information that is in your company’s possession. With certification to this standard, you can prove to your customers and other stakeholders that you are in control of the security of the information in your domain.

Compliant supports businesses across the UK and beyond in becoming UKAS ISO certified within timescales and to budget.

The standard implements a technique-based approach for setting up, implementing, using, monitoring, controlling, and improving every section of your Information Security Management System (ISMS). ISO 27001 also defines how businesses should manage the risk related to an information security risk, including staff training, procedures, and policies.

ISO 27001 highlights data security requirements and guidelines intended to safeguard a company’s information assets against unauthorised access or loss and provide a way of showing their commitment to data security management via certification. The globally recognised certification entails an organisation structure, physical and technical safeguards, access control mechanisms, information classification, risk assessment process, reporting guidelines, monitoring, procedures, and information security policies.

Implementing ISO 27001 offers a structure for information security management good practice which assists an organisation in undertaking the following:

• Safeguard employee and client information
• Handle the risks related to information security well
• Attain compliance with entities like the EU General Data Protection Regulation
• Safeguard the company’s brand image

Attaining ISO 27001 will help your company protect and manage important information and data assets. By becoming ISO 27001 certified, your company will be in a position to enjoy various benefits including consistent performance and cost savings.

What does ISO 27001 cover?

ISO 27001 certification is a globally accepted standard for implementing effective information security within organisations. The standard assists businesses in fully managing their security system of assets including employee details, intellectual property, financial information, and information entrusted to the company by someone else. Here we look into the 14 areas covered by ISO 27001:

1. Information security policies

Compliant’s ISO 27001 package contains policies with physical, technical, and legal rules that support a company’s IT risk management processes.

Some of the security policies that we provide include cloud computing, cloud service specifications, internet acceptability, information security and social media. Annex 8 of our ISO 27001 framework includes over 130 documents that Compliant can support with.

2. Overall organisation of information security

In this section, the control offers the essential structure for operation and implementation of information security by explaining and evidencing its entire internal organisation including responsibilities and roles.

3. Human resource security

In this section, the controls make sure that employees are appropriately appointed and trained, and their details are handled securely. Also fundamentals of responsibilities, disciplinary actions and termination of the agreement are set out.

4. Asset management

In this section, the controls make sure that the information security assets such as information, processing devices, storage devices, etc., are stated, which responsibilities for all those information securities are addressed, and that individuals are aware of how to deal with them in the right way to pre-dictated classification levels.

5. Access control

In this section, the controls limit the access to information assets and information in accordance with the actual business needs. In addition, the controls are given in this section for both logical and physical access.

6. Cryptography

In this section, the controls offer the basis for properly using the solutions such as encryption to safeguard integrity, authenticity, and confidentiality.

7. Physical & environmental security

In this section, the control level ensures that no unauthorised person has access to information that they do not need access to. It extends to giving protection to the equipment as well.

8. Operations security

The controls stated in this area ensure that the IT systems like software and operating systems are well protected and fully secured against any data loss. Moreover, the controls need the system set in place to record events and give evidence.

9. Communications security

In this section, the controls offer complete protection to the network services and infrastructure and the information that moves across the system.

10. System acquisition, development & maintenance

In this section, the control makes sure that information security is considered when buying a new information system or even during an upgrade.

11. Supplier relationships

In this section, the controls make sure that the outsourced activities done by suppliers use the right information security controls while pointing out the way to monitor every security performance of the 3rd party who have an interest.

12. Information security incident management

In this section, the control offers a structure to ensure the proper communication and handling of every incident and event so that they can be quickly resolved in a timely way. Additionally, they also explain how to keep evidence, and how an organisation can learn from their past to prevent the reoccurrence of the same issue.

13. Information security aspects of business continuity management

In this section, the controls ensure the continuity of info security management when disruptions occur and the presence of the information system.

14. Compliance

In this area, the control offers a framework to help prevent contractual, regulatory, statutory, and legal breaches.

Annex A18 of the Compliant framework provides ’Legal, Regulatory and Contractual Requirements’, a ‘Legal and Regulatory Procedure’ and policies to ensure compliance.

Is ISO 27001 a legal requirement?

Even though ISO 27001 is structured around setting up information security control, no statutory requirements need an organisation to comply with them. The standard fully recognises that each organisation comes with its own requirements when coming up with its ISMS, and not every aspect of the controls may be needed. Rather, organisations are needed to undertake activities that offer them a decision on which control they should implement. So, if your organisation needs to improve business processes, you need to follow this standard that guides on privacy, security, and ensuring the safety of information is guaranteed.

Is ISO 27001 expensive?

Most people think that implementing ISO 27001 certification is expensive. Organisations believe that they will have to invest more significant amounts of money into their equipment and IT systems. This is not always the case.

The cost of implementing ISO 27001 depends on each organisation. The cost of compliance may be greater than the initial investment, but there are a number of benefits that come with this practice. ISO 27001 certification can be used to help business reduce those costs by reducing data theft, increased customer retention and enhanced productivity. ISO 27001 certified organisations also benefit from reduced risks which include liabilities and costs.

Whenever you consider the costs associated with ISO 27001 certification, you need to consider how the prices are insignificant compared to the costs of a data breach. For example, in 2017, the research showed that data breach costs accumulated to $3.6 million.

Whenever you are coming up with your organisations’ budget for ISO 27001 certification, you will need to consider various costs. It would be best to consider the costs of implementing the information security management system and any certification costs, such as consultant’s fees and surveillances.

Keep in mind that the investment depends on the certification body you are using and the scope of the information security management system that you need; this is the size of your organisation and the risk levels to be incurred.

Compliant’s ISO certification proposals come in two parts; the quotation from the chosen certification body and the implementation cost from Compliant.

As a partner to many of the certification bodies we enjoy preferential day rates that can be passed directly onto our clients in the form of discounts. Most of the bodies that we work with and Compliant as a company offer deposit payments followed by flexible, interest free payment plans. There are also a range of grants available to fund ISO certifications, which Compliant can help with. We’ll event support with the paperwork to get you started.

Check out our payment plan information video here!

What are the ISO 27001 requirements?

There are a wide range of requirements needed to achieve ISO 27001 certification. These include;

1. Understanding the context of the organisation

Before you can start implementing ISO 27001 certification, you need to understand your organisation and its context in broader aspects. Who are your customers and suppliers? How do you manage your relationships and stakeholder information? How do you record activities? Who is responsible for what in your organisation and are they fully aware of their responsibilities? How and where is all of this recorded?

2. Getting to know the expectations and needs of the interested parties

You need to understand your interested parties very well for certification. These parties could be a group, an individual, stakeholders, or any other person interested in your ISMS. This awareness ensures that you meet their needs as required.

3. Determine the scope of ISMS

This is the most crucial part of any ISMS since it informs the auditors, staff, senior management, customers, and suppliers on those business areas that the ISMS covers.

4. Leadership and commitment

It is vital that information security is supported and driven by senior management. The framework clearly illustrates how top management lead by example and implement the standard across the organisation, making all staff aware of their responsibilities and contribution to the standard.

5. Information security policy

An effective information security policy needs to be developed and implemented. If your business needs support creating an effective policy that is relevant to your business and industry, we can help.

6. Organisational responsibilities, roles, and authorities

Top management should always ensure that the management system’ roles, obligations, and authorities are clear.

7. Actions to address opportunities and risks

This is all about planning any actions that aid in bringing out any risks and opportunities. Effective risk management is needed to meet all the certification requirements.

8. Planning to achieve information security objectives

You have a reason why you need to implement your management system and how it will be successful. Therefore, you will need business case builder materials to achieve more strategic outcomes from your management system.

9. Resources

You need to provide an adequate number of resources to receive this certification. These are the resources required to implement, establish, and improve the management system. Compliant can recommend what resources are needed and supply any that may be missing.

10. Competence

An organisation should be well acquainted with how competent their workers are since this affects the overall performance. An organisation should have qualified staff and record any job descriptions, training or qualifications.

11. Awareness

Your employees should be aware of the information security policy, their contribution to the effectiveness of the ISMS, and the results of the ISMS not conforming to the requirements. 

12. Communication

Good communication has a positive impact on the management system outcomes. This certification checks what your ISMS communicates, who does the communication and when it is communicated.

13. Documented information

You must describe your management system and how your organisation can achieve its outcomes. All the information related to the management system should be documented, well maintained and easy to find for your organisation to achieve ISO 27001 certification.

14. Operational planning and control

This shows how your organisation is achieving its work. It entails planning, implementation and controls set out to achieve the outcomes of the management system.

15. Information security risk treatment

Your organisation needs to implement the information security risk treatment plan and keep the documented information on the outcome of that risk treatment.

16. Monitoring, measurement, analysis and evaluation

Here, your organisation needs to illustrate the performance of the management system clearly. You will also need to evaluate the effectiveness of the management system to receive the certification.

17. Internal Audit

This requires your organisation to conduct internal audits at certain intervals to provide detailed information on how the management system conforms to the requirements.

18. Management review

Senior Management is tasked with conducting management reviews. These reviews ensure that the management system is very effective and achieves all its aims.

19. Nonconformity and corrective action

This deals with the improvements and actions your organisation takes to address any encountered nonconformities. A corrective action then follows, and is effectively recorded.

20. Continual improvement

The most important part of an information security management system is to see it achieving its intended objectives. This involves assessing, testing and reviewing the performance for continuous improvements.

What are the benefits of ISO 27001?

ISO 27001 certification is very helpful to your organisation in different ways. Here are some reasons why your organisation will benefit from this certification.

1. Helps in protecting your reputation from bad security threats

ISO 27001 certification keeps you safer from any security threats. Here, you have all the tools that help you strengthen your organisation across the pillars of security.

2. Aids in avoiding regulatory fines

This certification helps most organisations avoid costly penalties that arise whenever you do not comply with the data protection requirements such as General Data Protection Regulation (GDPR). With ISO 27001 certification, you can quickly achieve and maintain compliance just as you would with GDPR. This helps you to save more than you could have spent on penalties.

Organisations use ISO 27001 best practices to guide and stay GDPR compliant. View the full article ‘A simple guide – Does ISO 27001 cover GDPR data protection’ here.

3. Maintains your reputation

Whenever you achieve ISO 27001 compliance, you can easily demonstrate how you consider the organisation’s information security. This makes it easier for you to win the hearts of new businesses and maintain the best reputation with your clients and customers. In some cases, you will find that most organisations will prefer working with those organisations that have ISO 27001 certification in place.

4. Helpful in improving your focus and structure

As time goes by, your organisation will grow and adapt; however, workers can quickly lose focus on their responsibilities regarding information security. With ISO 27001 certification, you are assured of the needed flexibility to ensure that everyone maintains their focus on the tasks regarding information security. Organisations can go even further and conduct an annual risk assessment to make changes if needed.

5. Reduces frequent audits

ISO 27001 is accepted throughout the globe since it offers you greater solutions when it comes to security and reducing frequent customer audits. This also helps reduce the number of days required for external auditors.

Summary: Is ISO 27001 worth it?

Being ISO 27001-certified is definitely worth it. With this standard, the security culture is enhanced across your entire organisation. For more information on ISO 27001, view our latest video interview with Compliant Director and Lead Auditor, Mark Henderson here.